Examkin

Design Secure Architectures

438 questions

All types438Multiple choice214Multiple select224
Question 141Question →

A global e-learning platform delivers video-on-demand content and user profile APIs using Amazon CloudFront, an Application Load Balancer (ALB), and Amazon EC2 instances. Recently, the platform experienced a distributed denial of service (DDoS) attack targeting the application layer (Layer 7) with a flood of HTTP POST requests, which overwhelmed the backend EC2 instances. A solutions architect must design a secure architecture to mitigate future Layer 7 DDoS attacks and prevent unauthorized traffic from bypassing CloudFront to access the ALB directly.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Associate AWS WAF with the Amazon CloudFront distribution and configure a rate-based rule.; Configure the Application Load Balancer security group to allow inbound traffic only from the Amazon CloudFront IP ranges using the AWS-managed prefix list.

Answer

Associate AWS WAF with the Amazon CloudFront distribution and configure a rate-based rule, and configure the Application Load Balancer security group to allow inbound traffic only from the Amazon CloudFront IP ranges using the AWS-managed prefix list.
To mitigate Layer 7 HTTP floods, AWS WAF rate-based rules must be deployed on the CloudFront distribution. To prevent users from bypassing CloudFront and accessing the Application Load Balancer directly, the ALB's security group must restrict inbound traffic using the AWS-managed prefix list for CloudFront.

Step-by-Step Solution

1
Address the Layer 7 DDoS requirement.
Identify that AWS WAF associated with Amazon CloudFront supports rate-based rules to limit incoming HTTP flood requests at the edge.
AWS WAF inspects HTTP/HTTPS traffic and can dynamically rate-limit traffic exceeding thresholds to prevent origin exhaustion.
2
Address the bypass prevention requirement.
Configure the ALB's security group to only permit inbound traffic originating from CloudFront's edge servers.
Using the AWS-managed prefix list for CloudFront ensures that only traffic coming from CloudFront's IP space is allowed into the ALB, preventing direct internet access.

Key Concept

Securing web applications at the edge using Amazon CloudFront IP range security groups and AWS WAF rate-limiting.
Estimated Time:2m 0s
Question 142Question →

A financial technology startup has multiple AWS accounts managed under an AWS Organizations organization. The startup needs to implement a centralized logging and threat detection strategy. The security team must be alerted within minutes of any unauthorized IAM privilege escalation attempts or modifications to critical network infrastructure across all accounts. Additionally, they must ensure that all API activity log files are protected against modification or deletion, even by administrative users. Which combination of steps should the solutions architect recommend to meet these security monitoring and threat detection requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable an AWS CloudTrail organization trail in the management account, configure it to deliver log files to a centralized Amazon S3 bucket in a dedicated security account, and enable CloudTrail log file integrity validation.; Designate a security account as the Amazon GuardDuty delegated administrator, enable GuardDuty across all organization member accounts, and configure Amazon EventBridge to route GuardDuty findings to the security team.

Answer

The correct options are: enabling an AWS CloudTrail organization trail with log file integrity validation delivered to a centralized S3 bucket, and designating a delegated administrator for Amazon GuardDuty to monitor the logs and route findings via Amazon EventBridge.
Centralizing CloudTrail logs in a dedicated security account under an Organization trail provides a tamper-resistant architecture. Enabling CloudTrail log file integrity validation allows the detection of unauthorized modifications. Amazon GuardDuty analyses CloudTrail logs across accounts to identify privilege escalation and other security threats, and EventBridge provides the routing mechanism for alerts.

Step-by-Step Solution

1
Address log security and auditing requirements.
Create a centralized AWS CloudTrail trail across the entire organization that deposits logs into a secure Amazon S3 bucket within a designated security account. Enable log file integrity validation to detect unauthorized modifications.
This establishes a tamper-evident audit trail of all API activity across the organization, satisfying the requirement to protect logs from deletion or modification by administrative users.
2
Address real-time threat detection and alerting requirements.
Enable Amazon GuardDuty in all accounts by delegating administration to the security account, and set up an Amazon EventBridge rule to route GuardDuty findings to the security team.
GuardDuty natively analyzes CloudTrail logs to detect anomalous IAM activity and potential privilege escalation. EventBridge allows automated routing of these findings for rapid alerting.

Key Concept

Centralized security monitoring, log integrity, and multi-account threat detection in AWS Organizations using CloudTrail and GuardDuty.
Question 143Question →

A financial services company hosts a critical transaction application on Amazon EC2 instances within a private subnet. The security team must implement a solution to monitor all inbound and outbound network traffic at the subnet level to detect network anomalies, such as active port scanning and unauthorized SSH connection attempts, without impacting application performance. Which solution meets these requirements?

Show answer & explanation

Answer: Enable VPC Flow Logs on the subnet to capture traffic data, and enable Amazon GuardDuty to analyze the flow logs and generate security findings.

Answer

Enable VPC Flow Logs on the subnet to capture traffic data, and enable Amazon GuardDuty to analyze the flow logs and generate security findings.
The correct solution involves enabling VPC Flow Logs and Amazon GuardDuty. VPC Flow Logs capture network traffic data at the subnet level without introducing any performance overhead on the EC2 instances. Amazon GuardDuty automatically processes these flow logs out-of-band to identify malicious activity, such as port scanning or unauthorized SSH brute-force attempts.

Step-by-Step Solution

1
Enable VPC Flow Logs for the target subnet.
Network traffic metadata (source, destination, protocol, port, action) is captured out-of-band and published to Amazon CloudWatch Logs or Amazon S3.
This establishes subnet-level traffic visibility without installing agent software or introducing CPU/memory latency on the EC2 instances.
2
Enable Amazon GuardDuty in the AWS account.
GuardDuty automatically reads VPC Flow Logs, Route 53 resolver query logs, and CloudTrail events at the platform level.
This offloads threat detection analysis to a managed service that uses threat intelligence feeds to identify signatures like port scanning.
3
Process GuardDuty findings.
Alerts and findings are generated inside the GuardDuty console and can be sent to Amazon EventBridge for automated notification or remediation.
This ensures the security team receives immediate notification of anomalous activity.

Key Concept

Out-of-band network threat detection using VPC Flow Logs and Amazon GuardDuty
Estimated Time:2m 0s
Question 144Question →

A company needs to grant a third-party audit team temporary access to run query analysis on Amazon Athena using data stored in an Amazon S3 bucket. The audit team manages their users through their own external identity provider (IdP). Which of the following is the most secure method to grant the audit team access according to AWS security best practices?

Show answer & explanation

Answer: Configure identity federation using the audit team's external identity provider to allow their users to assume an IAM role that grants least-privilege permissions to Amazon Athena and the S3 bucket.

Answer

Configure identity federation using the audit team's external identity provider to allow their users to assume an IAM role that grants least-privilege permissions to Amazon Athena and the S3 bucket.
The correct answer is to configure identity federation using the external identity provider (IdP) to allow the audit team to assume an IAM role. This solution avoids creating local IAM users with long-term credentials and aligns with the AWS well-architected framework security pillar, providing short-lived, least-privilege credentials.

Step-by-Step Solution

1
Identify the requirement to grant temporary access to external users managed by an external identity provider.
Determine that AWS Identity Federation should be utilized instead of creating local IAM users.
Using federation avoids the creation and management of long-term credentials for external entities, satisfying security best practices.
2
Define the mechanism of access delegation using IAM roles.
Establish an IAM role with a trust policy that trusts the external IdP, granting least-privilege permissions to Amazon Athena and the Amazon S3 bucket.
IAM roles provide temporary, short-lived security credentials which automatically expire, reducing the blast radius of credential leaks.
3
Eliminate unsafe credential handling and administrative root usage.
Reject options proposing the sharing of root credentials or storing active access keys in plaintext parameter store.
Root usage must be avoided for standard tasks, and credentials must always be encrypted at rest and in transit.

Key Concept

AWS Identity Federation and IAM Roles
Question 145Question →

A company has a development workload running in AWS Account A. Developers assume an IAM role named `DeveloperRole` in Account A to perform their tasks. The solutions architect needs to grant these developers access to an Amazon S3 bucket named `prod-data-archive` located in AWS Account B. The access must be restricted to requests originating from the corporate office IP range (198.51.100.0/22198.51.100.0/22). Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In Account A, attach a policy to the `DeveloperRole` that allows the `s3:GetObject` and `s3:ListBucket` actions on the `prod-data-archive` bucket.; In Account B, attach a bucket policy to the `prod-data-archive` bucket that grants the `s3:GetObject` and `s3:ListBucket` permissions to the `DeveloperRole` in Account A, with a condition that restricts access to the source IP range 198.51.100.0/22198.51.100.0/22.

Answer

Attaching an IAM policy to the role in the source account to allow access to the bucket, and attaching a bucket policy in the destination account that grants access to that role under a condition restricting requests to the corporate IP range.
For cross-account S3 access, permissions must be enabled on both sides: the IAM role policy in the source account must allow outbound access to the bucket, and the S3 bucket policy in the destination account must allow inbound access from the role. The S3 bucket policy can use the `aws:SourceIp` condition to enforce that requests originate only from the corporate IP range.

Step-by-Step Solution

1
Configure the identity-based policy in the source account.
The IAM role `DeveloperRole` in Account A is granted permissions to call S3 actions on the external bucket.
IAM identity policies govern outbound permissions from a principal.
2
Configure the resource-based policy in the destination account.
The S3 bucket policy in Account B is updated to allow the ARN of the IAM role from Account A.
Resource policies govern inbound access to a resource from external accounts.
3
Apply source network constraints to the resource policy.
A condition block checking `aws:SourceIp` against 198.51.100.0/22198.51.100.0/22 is added to the bucket policy.
This restricts bucket access exclusively to requests originating from the corporate network.

Key Concept

Cross-account access to Amazon S3 requires permissions to be granted both on the IAM identity in the source account and on the S3 bucket policy in the target account.
Question 146Question →

A company is migrating its deployment pipeline from a self-hosted server to GitHub Actions. The pipeline workflows must deploy serverless applications in a production AWS account and retrieve sensitive database credentials. The company's security policy requires that all database credentials be rotated automatically every 30 days and strictly prohibits storing long-term AWS credentials or plaintext secrets in external repositories.

Which combination of actions should a solutions architect recommend to meet these security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an OpenID Connect (OIDC) identity provider in AWS IAM for GitHub, and create an IAM role with a trust policy that allows the `sts:AssumeRoleWithWebIdentity` action restricted to the specific GitHub repository.; Store the database credentials in AWS Secrets Manager, configure automatic rotation every 30 days using an AWS Lambda function, and grant the IAM role permissions to retrieve the secret.

Answer

To securely integrate GitHub Actions and manage database credentials, configure an OpenID Connect (OIDC) identity provider in AWS IAM with an IAM role using web identity federation. Additionally, store the database credentials in AWS Secrets Manager and set up automatic 30-day rotation using an AWS Lambda function.
Establishing an OIDC identity provider in AWS IAM enables GitHub Actions workflows to request short-lived temporary security credentials using the `sts:AssumeRoleWithWebIdentity` action. This removes the need for storing long-term IAM user access keys in GitHub. Storing the database credentials in AWS Secrets Manager allows native integration with rotation schedules using Lambda functions to enforce the 30-day rotation policy.

Step-by-Step Solution

1
Configure an OpenID Connect (OIDC) identity provider for GitHub Actions in the IAM console.
Establishes a trust relationship between AWS and GitHub's Identity Provider.
Allows AWS to verify identity tokens issued by GitHub Actions.
2
Create an IAM role with a trust policy allowing the `sts:AssumeRoleWithWebIdentity` action, constrained to the specific GitHub organization and repository using condition keys.
Provides temporary security credentials for the GitHub runner without storing long-term credentials.
Enforces least privilege access and avoids credential exposure.
3
Store the database password as a secret in AWS Secrets Manager.
The secret is encrypted at rest using an AWS KMS Customer Managed Key.
Protects sensitive database credentials from being exposed in plaintext.
4
Enable automatic rotation in AWS Secrets Manager with a 30-day schedule using a rotation AWS Lambda function.
The Lambda function automatically rotates the database credentials in both the database and Secrets Manager.
Satisfies the regulatory requirement for automatic 30-day credential rotation.

Key Concept

Identity federation using OpenID Connect (OIDC) and automated secrets management with rotation.
Estimated Time:2m 0s
Question 147Question →

An enterprise is migrating its legacy inventory system to a multi-account AWS environment. A legacy application running on-premises must write daily inventory reports directly to an Amazon S3 bucket located in a centralized AWS account. The company's security policy strictly prohibits the storage of long-term AWS security credentials on-premises. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Implement AWS IAM Roles Anywhere. Configure a trust anchor with the on-premises Certificate Authority (CA), define an IAM role with permissions to write to the S3 bucket, and exchange X.509 certificates for temporary AWS credentials.

Answer

Implement AWS IAM Roles Anywhere by establishing a trust anchor with the on-premises Certificate Authority (CA), defining an IAM role, and exchanging X.509 certificates for temporary AWS credentials.
The solution that configures AWS IAM Roles Anywhere is correct because it uses X.509 digital certificates from an on-premises Certificate Authority to authenticate and retrieve temporary, short-lived credentials. This avoids the security risk of storing long-term credentials on physical on-premises servers.

Step-by-Step Solution

1
Analyze the security constraints.
The application is on-premises and must access AWS resources (Amazon S3), but the local storage of long-term AWS credentials (like IAM access keys) is forbidden.
To identify which mechanism can provide secure, short-lived credentials for non-AWS workloads.
2
Evaluate AWS credential provisioning options for on-premises workloads.
AWS IAM Roles Anywhere allows non-AWS workloads to use local digital certificates (X.509) to obtain temporary security credentials via IAM roles.
IAM Roles Anywhere is the native AWS service designed specifically to eliminate long-term credentials for workloads running outside of AWS.
3
Define the implementation details.
Create a trust anchor linked to the internal CA, define a role with S3 write access, and configure the application to request temporary session credentials using the certificate.
This establishes a cryptographic trust chain between the local infrastructure and AWS without introducing static credentials.

Key Concept

Exchanging X.509 certificates for short-lived credentials via AWS IAM Roles Anywhere
Question 148Question →

An enterprise company wants to grant its employees access to multiple AWS accounts within AWS Organizations. The company uses an external identity provider (IdP) that supports SAML 2.0 to manage its workforce. The company wants to minimize administrative overhead and avoid creating duplicate credentials.

Which solution meets these requirements with the least operational complexity?

Show answer & explanation

Answer: Enable AWS IAM Identity Center, connect it to the external identity provider via SAML 2.0, and map corporate groups to AWS permission sets in the target accounts.

Answer

Enable AWS IAM Identity Center, connect it to the external identity provider via SAML 2.0, and map corporate groups to AWS permission sets in the target accounts.
Configuring AWS IAM Identity Center with a SAML 2.0 external identity provider enables single sign-on (SSO) across multiple AWS accounts. By mapping corporate groups to AWS permission sets, administrators can grant permissions centrally, eliminating the need to create individual IAM users or credentials in each account.

Step-by-Step Solution

1
Identify the requirement to manage access across multiple AWS accounts using an existing external Identity Provider (IdP) supporting SAML 2.0.
Determine that federation is required to avoid duplicating credentials and minimize administrative overhead.
Federation allows users to log in using their existing corporate credentials.
2
Evaluate the options for multi-account federation in AWS.
AWS IAM Identity Center is the AWS-recommended service for centralizing access control across AWS Organizations.
It supports SAML 2.0 integration and allows mapping corporate directory groups directly to AWS permission sets without managing individual IAM users.

Key Concept

AWS IAM Identity Center provides centralized management of SSO access to multiple AWS accounts and SAML applications using an external IdP.
Question 149Question →

A company is designing a security baseline for its new multi-account AWS environment. The solution must address two requirements:
First, 500500 corporate identity directory users need single sign-on access to the AWS Management Console and CLI.
Second, a containerized application running on Amazon ECS needs to securely retrieve database credentials that must be rotated every 3030 days.
Which combination of actions should the solutions architect recommend to meet these requirements securely? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the company's identity provider and assign permissions using permission sets; Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function

Answer

Configure AWS IAM Identity Center to federate the company's identity provider, and store the database credentials in AWS Secrets Manager with automatic rotation using an AWS Lambda function.
Centralizing access control through AWS IAM Identity Center provides federated single sign-on without the overhead and risk of long-term IAM users. For sensitive data like database credentials, AWS Secrets Manager securely stores the secret and automates its rotation using an AWS Lambda function, maintaining compliance with security standards.

Step-by-Step Solution

1
Address the single sign-on requirement for the 500500 users by configuring federation.
AWS IAM Identity Center is configured to connect to the external identity provider, enabling users to access AWS accounts with temporary credentials.
This avoids creating individual IAM users, complying with security best practices for identity management.
2
Address the secure credential storage and 3030-day rotation requirement.
AWS Secrets Manager is chosen to store the database credentials, and its built-in rotation feature is enabled with an AWS Lambda function running every 3030 days.
Secrets Manager provides native support for rotating database credentials automatically, which is not available as a native feature in Systems Manager Parameter Store without custom scripting, and is much more secure than storing credentials in plaintext.

Key Concept

Centralized identity federation using AWS IAM Identity Center and automated secrets management with AWS Secrets Manager.
Question 150Question →

A company wants to grant a third-party security audit application access to read log files in an Amazon S3 bucket within the company's AWS account. The third-party application runs in the auditor's AWS account. The company's security policy dictates that no long-term credentials can be shared, and the design must prevent the 'confused deputy' problem. Which configuration should a solutions architect implement to meet these security requirements?

Show answer & explanation

Answer: Create an IAM role in the company's account with a trust policy that allows the auditor's AWS account to assume the role, conditioning the trust policy on a unique External ID provided by the auditor. Attach an IAM policy to the role that grants read-only permissions to the S3 bucket.

Answer

Create an IAM role in the company's account with a trust policy that allows the auditor's AWS account to assume the role, conditioning the trust policy on a unique External ID provided by the auditor. Attach an IAM policy to the role that grants read-only permissions to the S3 bucket.
The correct configuration involves creating an IAM role in the company's account with a trust policy that allows the auditor's account to assume the role. By requiring an External ID in the condition block of the trust policy, the configuration prevents the confused deputy problem, which is a security risk where an entity that does not have permission to access a resource can coerce a more privileged entity (the third-party audit tool) to access it. An IAM policy attached to the role restricts permissions to read-only access on the S3 log bucket, following the principle of least privilege.

Step-by-Step Solution

1
Establish secure access for the third-party AWS account by using IAM roles instead of sharing long-term credentials.
An IAM role is defined in the resource owner's account that can be assumed by the trusted third-party account using temporary security credentials.
This satisfies the security requirement to avoid sharing long-term access keys or secret keys.
2
Address the confused deputy problem by adding a condition to the role's trust policy.
The role's trust policy is configured with an External ID condition that requires the third party to present a specific, unique string when assuming the role.
The External ID ensures that the role cannot be assumed by the third party on behalf of other customers, preventing unauthorized cross-tenant access.
3
Apply the principle of least privilege by attaching a permissions policy to the IAM role.
A permissions policy is attached that grants read-only permissions limited to the specific S3 log bucket.
This ensures the auditor has only the minimum necessary permissions required to perform their security audit.

Key Concept

AWS IAM Roles and External IDs for Secure Cross-Account Third-Party Access
Estimated Time:1m 30s
Question 151Question →

A university needs to provide its staff members with access to the AWS Management Console. The staff identities are stored in an external SAML 2.0-compliant identity provider. The security team wants to ensure that no long-term AWS credentials are created for these users, and access is managed centrally. Which AWS service is the recommended solution to meet this requirement?

Show answer & explanation

Answer: AWS IAM Identity Center

Answer

AWS IAM Identity Center
AWS IAM Identity Center allows organizations to configure single sign-on access to the AWS Management Console by federating with external SAML 2.0 identity providers. It dynamically provides short-term credentials, removing the need for long-term IAM credentials and reducing management overhead.

Step-by-Step Solution

1
Identify the requirement for federated access using an external SAML 2.0-compliant identity provider.
The solution must authenticate external identities without duplicating them locally.
This rules out solutions that require local directory hosting or manually creating local credentials.
2
Identify the constraint regarding credentials and management overhead.
Long-term credentials must not be generated, and management should be centralized.
This rules out individual IAM users and sharing the root account credentials.
3
Select the modern AWS service designed for central single sign-on and integration with external identity providers.
AWS IAM Identity Center enables connection with external SAML 2.0 providers and provides short-term credentials dynamically.
This matches all security and operational requirements.

Key Concept

AWS IAM Identity Center provides federated single sign-on access to the AWS Management Console from external SAML 2.0 identity providers without the use of long-term credentials.
Estimated Time:1m 0s
Question 152Question →

A company wants to grant its on-premises Active Directory users access to the AWS Management Console. The solutions architect needs to configure identity federation using AWS IAM Identity Center to allow users to sign in with their existing corporate credentials.

Which two actions must the solutions architect perform to establish this integration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Connect the on-premises Active Directory to AWS using AD Connector.; Enable AWS IAM Identity Center and configure the identity source to use the connected directory.

Answer

Connect the on-premises Active Directory to AWS using AD Connector, and enable AWS IAM Identity Center to use the connected directory as the identity source.
To integrate an on-premises Active Directory with AWS for federated access, the solutions architect must connect the on-premises directory to AWS (e.g., using AD Connector) and configure AWS IAM Identity Center to use that directory as the identity source. This allows users to authenticate using their existing corporate credentials without storing credentials in the AWS cloud.

Step-by-Step Solution

1
Establish a connection between the on-premises Active Directory and AWS.
AWS Directory Service AD Connector is configured to route authentication requests to the on-premises domain controllers.
This avoids synchronization or replication of passwords to AWS and allows directory queries to reach the on-premises infrastructure.
2
Configure AWS IAM Identity Center to use the external directory.
IAM Identity Center is configured with the connected directory as its identity source.
This allows corporate users to log in to the AWS Management Console with their existing Active Directory credentials.

Key Concept

Federating an on-premises Active Directory with AWS IAM Identity Center using AD Connector to allow single sign-on without creating individual IAM users.
Estimated Time:1m 0s
Question 153Question →

A retail enterprise has recently adopted a multi-account AWS environment using AWS Organizations. The IT security team must enable corporate employees to log in to the AWS Management Console across multiple accounts using their existing Microsoft Active Directory credentials, without creating permanent IAM credentials for each user. Which AWS service should the solutions architect recommend to meet these requirements with the least operational overhead?

Show answer & explanation

Answer: AWS IAM Identity Center

Answer

AWS IAM Identity Center
AWS IAM Identity Center is the recommended service for centrally managing SSO access to multiple AWS accounts. It connects directly with an external Microsoft Active Directory and eliminates the need to manage individual IAM users or permanent credentials.

Step-by-Step Solution

1
Identify the core requirement, which is to allow enterprise users to access multiple AWS accounts centrally using their existing Microsoft Active Directory credentials without creating individual IAM users.
Centralized federation is required.
This minimizes operational overhead and avoids managing long-term IAM credentials for every employee.
2
Evaluate the available AWS services that support integration with external identity providers (IdPs) like Microsoft Active Directory and multi-account setups in AWS Organizations.
AWS IAM Identity Center is the modern, recommended service for multi-account federation.
It natively integrates with AWS Organizations and external directories to enable single sign-on (SSO) with minimal configuration.

Key Concept

Centralized multi-account federation using AWS IAM Identity Center and external directory integration
Question 154Question →

A company is designing a new security strategy to grant its development team access to AWS resources. The developers are currently authenticated via an on-premises Active Directory. The solutions architect must implement a solution that allows developers to access the AWS Management Console and AWS CLI without introducing the administrative overhead of managing individual long-term credentials in AWS. Which solution should the solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the on-premises Active Directory, and assign AWS permission sets to the Active Directory groups.

Answer

Configure AWS IAM Identity Center to federate with the on-premises Active Directory, and assign AWS permission sets to the Active Directory groups.
The correct solution uses AWS IAM Identity Center to federate with the on-premises Active Directory. This allows the organization to leverage existing user identities and group memberships. Security policies (permission sets) are mapped to these groups, enabling developers to sign in using their existing Active Directory credentials and obtain short-lived, temporary access keys for the AWS Management Console and CLI, which eliminates the administrative overhead of managing IAM users and long-term credentials.

Step-by-Step Solution

1
Establish federation between the on-premises Active Directory and AWS IAM Identity Center.
AWS IAM Identity Center trusts the Active Directory as the external Identity Provider (IdP) for user authentication.
This removes the need to recreate user identities in AWS and allows engineers to use single sign-on (SSO) with their existing enterprise credentials.
2
Create AWS IAM permission sets representing the access levels required by the development team.
Defined policies that grant specific permissions to perform actions on EC2 and RDS resources.
Permission sets define what actions federated users can perform once they sign into an AWS account.
3
Map the Active Directory developer groups to the corresponding AWS accounts and permission sets.
When developers authenticate through the IdP, they are dynamically assigned the appropriate IAM roles and temporary security credentials.
This automates access control, enforces the principle of least privilege, and avoids managing long-term AWS access keys.

Key Concept

Identity Federation and Single Sign-On (SSO) using AWS IAM Identity Center
Question 155Question →

A financial services company is setting up a hybrid cloud environment. The company needs to allow its on-premises Active Directory users to log in to the AWS Management Console to manage Amazon EC2 instances. The security policy states that user credentials must not be stored or replicated in the AWS Cloud, and administrative effort must be minimized. Which two actions should a solutions architect take to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable AWS IAM Identity Center and configure it to use AWS Directory Service as the identity source.; Configure an AD Connector in AWS Directory Service to redirect directory requests to the on-premises Active Directory.

Answer

Enabling AWS IAM Identity Center as the identity source and configuring AD Connector in AWS Directory Service to proxy authentication requests directly to the on-premises Active Directory.
The correct solution involves enabling AWS IAM Identity Center and connecting it to the on-premises Active Directory via an AD Connector. AD Connector functions as a gateway to forward authentication requests to the on-premises domain controllers without caching or replicating passwords in the AWS Cloud. AWS IAM Identity Center then maps those authenticated users to specific AWS IAM roles, minimizing operational overhead.

Step-by-Step Solution

1
Select a gateway method to integrate the on-premises Active Directory with AWS.
Identify that AD Connector acts as a directory gateway that proxies authentication requests directly to the on-premises Active Directory without database replication.
This satisfies the constraint of not replicating credentials to the AWS Cloud while maintaining on-premises AD as the source of truth.
2
Set up a centralized single sign-on service for console access.
Enable AWS IAM Identity Center and configure its identity source to point to the AWS Directory Service directory.
This allows the solutions architect to map Active Directory groups to AWS permissions and provides users with a single portal for console access.

Key Concept

Using AD Connector alongside AWS IAM Identity Center allows organizations to federate their existing on-premises Active Directory to AWS without replicating credentials or introducing heavy management overhead.
Question 156Question →

An enterprise is migrating its applications to a multi-account environment managed by AWS Organizations. The company's security policy requires corporate users to authenticate using their existing on-premises Active Directory credentials to access the AWS Management Console of various AWS accounts. The solution must enforce multi-factor authentication (MFA), minimize operational overhead, and avoid synchronizing passwords or user directory data to the cloud. Which two actions should a solutions architect take to implement this architecture? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable AWS IAM Identity Center in the organization's management account and configure it to use Active Directory as the identity source.; Deploy an AWS Directory Service AD Connector in a VPC with VPN or Direct Connect connectivity to the on-premises domain controllers to proxy authentication requests.

Answer

Enable AWS IAM Identity Center in the organization's management account and configure it to use Active Directory as the identity source, and deploy an AWS Directory Service AD Connector in a VPC with network connectivity to on-premises domain controllers to proxy authentication requests.
Centralizing access control through AWS IAM Identity Center enabled in the organization's management account satisfies the enterprise requirement to manage access across multiple accounts. Pairing it with AD Connector provides a secure authentication proxy that forwards requests directly to the on-premises domain controllers via VPN or Direct Connect, ensuring passwords and directory data are not synchronized or replicated to AWS.

Step-by-Step Solution

1
Select a centralized management solution for multi-account access control.
AWS IAM Identity Center is selected as it integrates with AWS Organizations and external directories.
This avoids having to manually configure federation or local users in each individual account.
2
Determine the directory integration method that avoids password synchronization and database replication.
AD Connector is selected because it acts as an active directory proxy redirecting authentication requests without synchronizing user database details to AWS.
This satisfies the constraint of avoiding password synchronization and minimizing operational overhead.
3
Ensure secure connectivity between AWS and on-premises network.
Deploy the AD Connector within a VPC that has a VPN or Direct Connect connection to the on-premises domain controllers.
The AD Connector needs local network routing to reach domain controllers on port 389/445/88/53.

Key Concept

Centralized multi-account federation using AWS IAM Identity Center coupled with AD Connector to leverage on-premises Active Directory without password synchronization.
Question 157Question →

A solutions architect is configuring the network security settings for resources within an Amazon VPC. The architect needs to establish controls using both security groups and network access control lists (network ACLs). Which TWO of the following statements correctly describe the characteristics of security groups and network ACLs?

Select all that apply

Show answer & explanation

Answer: Security groups are stateful, meaning that return traffic is automatically allowed.; Network ACLs are stateless, meaning that return traffic must be explicitly allowed by outbound rules.

Answer

Security groups are stateful, meaning that return traffic is automatically allowed, and network ACLs are stateless, meaning that return traffic must be explicitly allowed by outbound rules.
The correct statements are that security groups are stateful and network ACLs are stateless. When traffic is permitted inbound through a security group, the return outbound traffic is automatically allowed. Conversely, network ACLs do not track session states, so return traffic must be explicitly permitted by a corresponding outbound rule.

Step-by-Step Solution

1
Determine the statefulness of both security groups and network ACLs.
Security groups are stateful (inbound allows outbound response), and network ACLs are stateless (both paths must be explicitly configured).
This is a fundamental operational difference between the two security layers.
2
Identify the boundary or level at which each security feature operates.
Security groups operate at the resource/instance level, whereas network ACLs operate at the subnet boundary level.
Correctly applying rules requires knowing whether they affect specific instances or the entire subnet.
3
Analyze the rule actions supported by each feature.
Security groups only support allow rules, whereas network ACLs support both allow and deny rules.
This determines how explicit blocklists or default-deny configurations should be implemented.

Key Concept

Operational differences, statefulness, and boundary levels of Security Groups and Network ACLs
Estimated Time:1m 0s
Question 158Question →

A company is establishing a multi-account environment using AWS Organizations. The security team wants to delegate the ability to create IAM roles to the development team lead in a member account. However, the security team must ensure that the team lead cannot create roles that grant permissions exceeding a defined threshold. Furthermore, compliance rules dictate that no entity within the member account—including the AWS account root user—should be able to stop or delete AWS CloudTrail logging. Which TWO options should the solutions architect choose to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Apply a Service Control Policy (SCP) at the member account level in AWS Organizations that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.; Configure an IAM permissions boundary that defines the maximum permitted actions, and attach an IAM policy to the team lead that allows role creation only if the permissions boundary is applied.

Answer

The solutions architect should apply a Service Control Policy (SCP) to deny CloudTrail logging modifications and configure an IAM permissions boundary to restrict the maximum permissions of roles created by the team lead.
Applying a Service Control Policy (SCP) to the member account is the only way to enforce restrictions (such as denying changes to CloudTrail) on all users and roles, including the member account's root user. Creating an IAM permissions boundary and requiring it during role creation ensures that the development team lead can create roles for developers without granting permissions that exceed the security team's defined boundary.

Step-by-Step Solution

1
Restricting CloudTrail modification across all users including root.
Apply an AWS Organizations Service Control Policy (SCP) denying cloudtrail:StopLogging and cloudtrail:DeleteTrail.
SCPs apply to all accounts in the Organization and affect all principals in member accounts, including the AWS account root user, which cannot be restricted by standard IAM policies.
2
Delegating role creation with a boundary.
Use an IAM permissions boundary defining the maximum allowed permissions.
Requiring a permissions boundary during role creation prevents delegated administrators from creating roles with privilege escalation capabilities.
3
Eliminating options with insecure patterns.
Reject options that propose using root credentials, creating management account IAM users, or storing access keys in plaintext.
These violate AWS security best practices regarding root account protection, federation, and secrets management.

Key Concept

Delegating IAM administration with permissions boundaries and enforcing organization-wide guardrails using SCPs.
Question 159Question →

An enterprise is hosting a secure data processing application in an Amazon VPC with a CIDR block of 10.0.0.0/16. The EC2 instances are located in a private subnet (10.0.1.0/24) and must retrieve datasets from an Amazon S3 bucket in the same AWS Region. A solutions architect has created an Amazon S3 Gateway VPC Endpoint and associated it with the route table of the private subnet. The security group assigned to the EC2 instances allows outbound TCP port 443 to 0.0.0.0/0 and denies all inbound traffic. A custom Network ACL (NACL) is associated with the private subnet and contains only the following rules:

* Inbound Rule 100: Allow TCP port 443 from 0.0.0.0/0
* Inbound Rule 110: Allow TCP ports 1024-65535 from 0.0.0.0/0
* Outbound Rule 100: Allow TCP port 443 to 0.0.0.0/0
* Outbound Rule 110: Allow TCP ports 1024-65535 to 0.0.0.0/0

During testing, the EC2 instances are unable to connect to the S3 bucket. Which of the following configuration omissions is preventing the EC2 instances from successfully accessing the Amazon S3 bucket?

Show answer & explanation

Answer: The custom Network ACL does not permit outbound UDP traffic on port 53 to the Route 53 Resolver (Amazon Provided DNS) at 10.0.0.2, blocking DNS resolution for the Amazon S3 endpoint.

Answer

The custom Network ACL does not permit outbound UDP traffic on port 53 to the Route 53 Resolver (Amazon Provided DNS) at 10.0.0.2, blocking DNS resolution for the Amazon S3 endpoint.
Custom Network ACLs are stateless and deny all traffic that is not explicitly allowed. When an EC2 instance attempts to connect to Amazon S3, it must first resolve the S3 domain name via the Amazon Provided DNS (Route 53 Resolver) located at 10.0.0.2. Since the custom Network ACL rules only allow TCP port 443 and TCP ephemeral ports, the UDP port 53 DNS queries are dropped at the subnet boundary, preventing the instances from obtaining the IP address for the S3 service.

Step-by-Step Solution

1
Analyze the request flow from the EC2 instance to Amazon S3.
The EC2 instance must first resolve the S3 DNS hostname (e.g., s3.us-east-1.amazonaws.com) to an IP address before it can initiate an HTTPS session over port 443.
DNS resolution is a prerequisite for establishing an HTTPS connection to the S3 bucket.
2
Identify the target and protocol for DNS resolution within the VPC.
The instance sends a DNS query (typically UDP port 53) to the Route 53 Resolver (Amazon Provided DNS), which resides at the reserved IP address 10.0.0.2 (VPC network range plus two).
By default, instances in a VPC use the Amazon Provided DNS server for name resolution.
3
Evaluate the custom Network ACL rules for the private subnet.
The custom Network ACL only allows TCP port 443 and TCP ports 1024-65535. Outbound UDP port 53 traffic to 10.0.0.2 is blocked because custom Network ACLs are stateless and deny all traffic not explicitly allowed.
Because Network ACLs are stateless, both the outbound request and the inbound return traffic must be permitted explicitly.
4
Formulate the correction needed to allow DNS resolution.
Add an outbound Network ACL rule to allow UDP port 53 traffic to the Route 53 Resolver, and ensure inbound rules allow the return UDP traffic on ephemeral ports.
This allows the DNS resolution packets to cross the subnet boundary successfully.

Key Concept

Stateless Network ACLs and VPC DNS Resolution
Question 160Question →

A company is designing a secure network architecture on AWS. The solutions architect needs to implement a security barrier that controls inbound and outbound traffic at the subnet boundary for all resources within that subnet. Which AWS feature should the architect configure to meet this requirement?

Show answer & explanation

Answer: Network Access Control Lists (Network ACLs)

Answer

Network Access Control Lists (Network ACLs)
Network Access Control Lists (Network ACLs) serve as a stateless firewall for controlling traffic in and out of one or more subnets, making them the correct choice for enforcing controls at the subnet boundary.

Step-by-Step Solution

1
Identify the target boundary for the network security control.
The requirement states that the barrier must operate at the subnet boundary.
This helps distinguish between network-level firewalls and host-level firewalls.
2
Evaluate the capabilities of the available AWS network security tools.
Security groups apply to elastic network interfaces (ENIs) at the instance level. Network ACLs are associated directly with subnets and process all traffic crossing the subnet boundaries.
Matching the boundary requirement ensures the correct security feature is selected.

Key Concept

Subnet-level network security controls
Estimated Time:45s
PreviousPage 8 / 22Next
Design Secure Architectures Practice Questions — AWS Certified Solutions Architect - Associate — Page 8 | Examkin